wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 761507 - Fix issues with adoptNode and conditional processing. r=dholbert

Browse Source
This commit is contained in:
Robert Longson 2012-06-06 09:15:53 +01:00
parent 1deb53b9d3
commit 96e7eb6a56
4 changed files with 28 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
content/svg/content/src/DOMSVGTests.cpp
View File

@ -269,7 +269,8 @@ DOMSVGTests::GetOrCreateStringListAttribute(PRUint8 aAttrEnum) const
stringListPtr->SetIsCommaSeparated(aAttrEnum == LANGUAGE);
nsresult rv = element->SetProperty(attrName,
stringListPtr,
ReleaseStringListPropertyValue);
ReleaseStringListPropertyValue,
true);
NS_ABORT_IF_FALSE(rv != NS_PROPTABLE_PROP_OVERWRITTEN,
"Setting property value when it's already set...?");

18
content/svg/content/src/crashtests/761507-1.svg Normal file
View File

@ -0,0 +1,18 @@
<svg xmlns="http://www.w3.org/2000/svg">
<script>
<![CDATA[
function boom()
{
var r = document.createElementNS("http://www.w3.org/2000/svg", "rect");
var f = r.requiredFeatures;
f.appendItem(1);
document.implementation.createDocument('', '', null).adoptNode(r);
r.getAttribute("requiredFeatures");
}
window.addEventListener("load", boom, false);
]]>
</script>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 380 B

1
content/svg/content/src/crashtests/crashtests.list
View File

@ -60,3 +60,4 @@ load 613899-2.svg
load zero-size-image.svg
load 723441-1.html
load 751515-1.svg
load 761507-1.svg

10
content/svg/content/src/nsSVGSVGElement.cpp
View File

@ -1275,7 +1275,8 @@ nsSVGSVGElement::
SVGPreserveAspectRatio* pAROverridePtr = new SVGPreserveAspectRatio(aPAR);
nsresult rv = SetProperty(nsGkAtoms::overridePreserveAspectRatio,
pAROverridePtr,
ReleasePreserveAspectRatioPropertyValue);
ReleasePreserveAspectRatioPropertyValue,
true);
NS_ABORT_IF_FALSE(rv != NS_PROPTABLE_PROP_OVERWRITTEN,
"Setting override value when it's already set...?");
@ -1387,7 +1388,8 @@ nsSVGSVGElement::SetViewBoxProperty(const nsSVGViewBoxRect& aViewBox)
nsSVGViewBoxRect* pViewBoxOverridePtr = new nsSVGViewBoxRect(aViewBox);
nsresult rv = SetProperty(nsGkAtoms::viewBox,
pViewBoxOverridePtr,
ReleaseViewBoxPropertyValue);
ReleaseViewBoxPropertyValue,
true);
NS_ABORT_IF_FALSE(rv != NS_PROPTABLE_PROP_OVERWRITTEN,
"Setting override value when it's already set...?");
@ -1420,7 +1422,9 @@ nsSVGSVGElement::ClearViewBoxProperty()
bool
nsSVGSVGElement::SetZoomAndPanProperty(PRUint16 aValue)
{
nsresult rv = SetProperty(nsGkAtoms::zoomAndPan, reinterpret_cast<void*>(aValue));
nsresult rv = SetProperty(nsGkAtoms::zoomAndPan,
reinterpret_cast<void*>(aValue),
nsnull, true);
NS_ABORT_IF_FALSE(rv != NS_PROPTABLE_PROP_OVERWRITTEN,
"Setting override value when it's already set...?");